Digital fingerprint tracking

ABSTRACT

Techniques are described for tracking intruders of a monitored property by the unique identifying characteristics or “digital fingerprints” of electronic devices carried by the intruders. A system detects an alarm event at a monitored property based on output from at least one sensor located at the monitored property. In response to detecting the alarm event at the monitored property, the system initiates a process to gather electronic identifiers for mobile electronic devices located within the monitored property at a time corresponding to the detected alarm event. The system determines electronic identifiers for the mobile electronic devices located within the monitored property at a time corresponding to the detected alarm event. The system stores in electronic storage, information indicating the determined electronic identifiers for the mobile electronic devices located within the monitored property at a time corresponding to the detected alarm event.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims the benefit of U.S. Provisional Application No.62/098,282, filed Dec. 30, 2014, and titled “Digital FingerprintTracking,” which is incorporated by reference.

TECHNICAL FIELD

This disclosure relates to security systems.

BACKGROUND

Many people equip homes and businesses with alarm systems to provideincreased security for their homes and businesses. Law enforcement mayutilize video recording data retrieved from cameras within homes andbusinesses monitored by alarm systems as evidence when prosecutingaccused perpetrators.

SUMMARY

Techniques are described for tracking intruders of a monitored propertyby the unique identifying characteristics or “digital fingerprints” ofelectronic devices carried by the intruders.

Implementations of the described techniques may include hardware, amethod or process implemented at least partially in hardware, or acomputer-readable storage medium encoded with executable instructionsthat, when executed by a processor, perform operations.

The operations may include detecting an alarm event at a monitoredproperty based on output from at least one sensor located at themonitored property and in response to detecting the alarm event at themonitored property, initiating a process to gather electronicidentifiers for mobile electronic devices located within the monitoredproperty at a time corresponding to the detected alarm event. Additionaloperations may include, based on the process to gather electronicidentifiers for mobile electronic devices located within the monitoredproperty at a time of the detected alarm event, determining electronicidentifiers for the mobile electronic devices located within themonitored property at a time corresponding to the detected alarm eventand storing, in electronic storage, information indicating thedetermined electronic identifiers for the mobile electronic deviceslocated within the monitored property at a time corresponding to thedetected alarm event.

Implementations may include one or more of the following features. Forexample, determining electronic identifiers for the mobile electronicdevices located within the monitored property at a time corresponding tothe detected alarm event may include transmitting, by a device detectorlocated at the monitored property and through a wireless communicationprotocol, a request for responses from mobile electronic devices at themonitored property, where each response includes the electronicidentifier for the mobile electronic device that received the request.In another example, determining electronic identifiers for the mobileelectronic devices located within the monitored property at a timecorresponding to the detected alarm event may include accessing storedinformation indicating electronic identifiers for mobile electronicdevices detected within the monitored property before the alarm eventwas detected. In yet another example, the electronic identifiers includemedia access control (MAC) addresses. In still another example,detecting an alarm event at a monitored property based on output from atleast one sensor located at the monitored property may include detectinga security breach at the monitored property based on output from a doorsensor that indicates a door is opened when a security system is armed.In another instance, operations may include determining, from amongmultiple types of alarm events, a type of the detected alarm event,based on the determined type of the detected alarm event, selecting,from among multiple electronic device detection procedures, anelectronic device detection procedure appropriate for the determinedtype of the detected alarm event, and executing the selected electronicdevice detection procedure.

In yet another instance, the type of the detected alarm event mayinclude a fire event and the electronic device detection proceduresincludes determining known mobile electronic devices within themonitored property and providing an alert that indicates the knownmobile electronic devices determined to be within the monitoredproperty. In still another instance, the type of the detected alarmevent includes a security breach event and the electronic devicedetection procedures includes determining unknown mobile electronicdevices within the monitored property and providing an alert thatindicates the unknown mobile electronic devices determined to be withinthe monitored property. In another example, the process to gatherelectronic identifiers for mobile electronic devices located within themonitored property at a time corresponding to the detected alarm eventincludes determining a location, within the monitored property, that isassociated with the alarm event, identifying a device detector locatedclosest or within a threshold distance of the location that isassociated with the alarm event, triggering the identified devicedetector to transmit a request for responses from mobile electronicdevices at the monitored property, receiving the responses from themobile electronic devices at the monitored property, and extracting,from each response, an electronic identifier for the mobile electronicdevice that provided the response. In yet another example, theoperations include evaluating the determined electronic identifiers forthe mobile electronic devices located within the monitored property at atime corresponding to the detected alarm event against one or morerules, based on the evaluation, determining an alarm response for thealarm event that is appropriate for the mobile electronic deviceslocated within the monitored property at a time corresponding to thedetected alarm event, and handling the detected alarm event based on thedetermined alarm response for the alarm event that is appropriate forthe mobile electronic devices located within the monitored property at atime corresponding to the detected alarm event. In still anotherexample, determining an alarm response for the alarm event that isappropriate for the mobile electronic devices located within themonitored property at a time corresponding to the detected alarm eventincludes in response to determining the mobile electronic devicesinclude an unknown mobile electronic device, determining an alarmresponse corresponding to detection of an unknown mobile electronicdevice. In another example, the operations include determining that anelectronic identifier received corresponds to an electronic identifierof a mobile electronic device known for the monitored property,identifying a user associated with the mobile electronic device knownfor the monitored property, identifying an alarm response correspondingto the user associated with the mobile electronic device known for themonitored property, and triggering the identified alarm responsecorresponding to the user associated with the mobile electronic deviceknown for the monitored property.

The details of one or more implementations are set forth in theaccompanying drawings and the description below. Other features will beapparent from the description and drawings, and from the claims.

DESCRIPTION OF DRAWINGS

FIGS. 1, 3, 5, 7, 9, 11, 13, and 14 illustrate example systems.

FIGS. 2, 4, 6, 8, 10, and 12 illustrate flowcharts of example processes.

DETAILED DESCRIPTION

Techniques are described for tracking intruders of a monitored propertyby the unique identifying characteristics or “digital fingerprints” oftheir electronic devices. The monitoring system at a monitored propertymay detect an alarm event, and based on the detection of the alarmevent, may attempt to collect and record information about electronicdevices that are within the monitored property during the detected alarmevent. Electronic devices have one or more identifying characteristicsthat are unique to each device. The monitoring system may record anyidentifying characteristics of the devices within the monitored propertyduring the alarm event. The monitoring system may also record anyelectronic transmissions that originate from, or are transferred to, theelectronic devices within the monitored property. The recordedidentifying characteristics and electronic transmissions may be used toidentify the devices that were present during the alarm event at themonitored property and this information may potentially be used toidentify an intruder.

FIG. 1 illustrates an example of an electronic system 100 configured toprovide surveillance and reporting of a monitored property. Theelectronic system 100 includes a network 105, a monitor control unit110, one or more user devices 140, 150, a monitoring application server160, and one or more electronic device detector(s) 162. In someexamples, the network 105 facilitates communications between the monitorcontrol unit 110, the one or more user devices 140, 150, the monitoringapplication server 160, and the one or more electronic devicedetector(s) 162.

The network 105 is configured to enable exchange of electroniccommunications between devices connected to the network 105. Forexample, the network 105 may be configured to enable exchange ofelectronic communications between the monitor control unit 110, the oneor more user devices 140, 150, the monitoring application server 160,and the one or more electronic device detector(s) 162. The network 105may include, for example, one or more of the Internet, Wide AreaNetworks (WANs), Local Area Networks (LANs), analog or digital wired andwireless telephone networks (e.g., a public switched telephone network(PSTN), Integrated Services Digital Network (ISDN), a cellular network,and Digital Subscriber Line (DSL)), radio, television, cable, satellite,or any other delivery or tunneling mechanism for carrying data. Network105 may include multiple networks or sub-networks, each of which mayinclude, for example, a wired or wireless data pathway. The network 105may include a circuit-switched network, a packet-switched data network,or any other network able to carry electronic communications (e.g., dataor voice communications). For example, the network 105 may includenetworks based on the Internet protocol (IP), asynchronous transfer mode(ATM), the PSTN, packet-switched networks based on IP, X.25, or FrameRelay, or other comparable technologies and may support voice using, forexample, VoIP, or other comparable protocols used for voicecommunications. The network 105 may include one or more networks thatinclude wireless data channels and wireless voice channels. The network105 may be a wireless network, a broadband network, or a combination ofnetworks including a wireless network and a broadband network.

The monitor control unit 110 includes a controller 112 and a networkmodule 114. The controller 112 is configured to control a monitoringsystem (e.g., a home alarm or security system) that includes the monitorcontrol unit 110. In some examples, the controller 112 may include aprocessor, or other control circuitry, configured to executeinstructions of a program that controls operation of an alarm system. Inthese examples, the controller 112 may be configured to receive inputfrom sensors, detectors, or other devices included in the alarm systemand control operations of devices included in the alarm system or otherhousehold devices (e.g., a thermostat, an appliance, lights, etc.). Forexample, the controller 112 may be configured to control operation ofthe network module 114 included in the monitor control unit 110.

The network module 114 is a communication device configured to exchangecommunications over the network 105. The network module 114 may be awireless communication module configured to exchange wirelesscommunications over the network 105. For example, the network module 114may be a wireless communication device configured to exchangecommunications over a wireless data channel and a wireless voicechannel. In this example, the network module 114 may transmit alarm dataover a wireless data channel and establish a two-way voice communicationsession over a wireless voice channel. The wireless communication devicemay include one or more of a GSM module, a radio modem, cellulartransmission module, or any type of module configured to exchangecommunications in one of the following formats: GSM or GPRS, CDMA, EDGEor EGPRS, EV-DO or EVDO, UMTS, or IP.

The one or more electronic device detectors 162 are electronic devicesthat are configured to identify unique characteristics of electronicdevices within the monitored property. The one or more electronic devicedetectors may be one or more electronic devices that are capable ofcommunicating with other electronic devices by various wirelessprotocols, such as wifi, Bluetooth, Bluetooth LE, zwave, zigbee, RFID,Near Field Communication, or another short-range wireless communicationprotocol. For example, an electronic device detector may be a digitalvideo recorder (DVR) with Bluetooth capability. The DVR may attempt tocommunicate with electronic devices that are within the DVR's Bluetoothrange and have Bluetooth capability. In some implementations, the one ormore electronic device detectors 162 are standalone devices that detectcharacteristics of electronic devices and communicate with one or morecomponents of the monitoring system. In addition, the one or moreelectronic device detectors 162 may be included in one or morecomponents of the monitoring system. For instance, the monitor controlunit 110 may be able to communicate over a short-range wirelesscommunication protocol (e.g., Wi-Fi or Bluetooth LE) and may serve asone of the one or more electronic device detectors 162.

The monitoring system may include one or more sensors. For example, themonitoring system may include multiple sensors 120. The sensors 120 mayinclude a contact sensor, a motion sensor, a glass break sensor, or anyother type of sensor included in an alarm system or security system. Thesensors 120 also may include an environmental sensor, such as atemperature sensor, a water sensor, a rain sensor, a wind sensor, alight sensor, a smoke detector, a carbon monoxide detector, an airquality sensor, etc. Some of the sensors may be configured to detectelectronic devices within the monitored property, and in these examples,the sensors may function as electronic device detectors. The sensors maycommunicate with the electronic devices and may retrieve uniqueidentifying information from the electronic devices when communicationis established between the electronic device and the sensor. The sensors120 may also include Wi-Fi sensors, Bluetooth sensors, RFID sensors,etc.

The monitor control unit 110 communicates with the module 122 and thecamera 130 to perform surveillance or monitoring. The module 122 isconnected to one or more lighting systems and is configured to controloperation of the one or more lighting systems. The module 122 maycontrol the one or more lighting systems based on commands received fromthe monitor control unit 110. The sensors 120, the module 122, and thecamera 130 communicate with the controller 112 over communication links124, 126, and 128. The communication links 124, 126, and 128 may includea wired or wireless data pathway configured to transmit signals from thesensors 120, the module 122, and the camera 130 to the controller 112.The sensors 120, the module 122, and the camera 130 may continuouslytransmit sensed values to the controller 112, periodically transmitsensed values to the controller 112, or transmit sensed values to thecontroller 112 in response to a change in a sensed value. Thecommunication link 128 over which the camera 130 and the controller 112communicate may include a local network. The camera 130 and thecontroller 112 may exchange images and commands over the local network.The local network may include 802.11 “Wi-Fi” wireless Ethernet (e.g.,using low-power Wi-Fi chipsets), Z-Wave, Zigbee, Bluetooth, “Homeplug”or other “Powerline” networks that operate over AC wiring, and aCategory 5 (CATS) or Category 6 (CAT6) wired Ethernet network.

The monitoring application server 160 is an electronic device configuredto provide monitoring services by exchanging electronic communicationswith the monitor control unit 110, and the one or more user devices 140,150 over the network 105. For example, the monitoring application server160 may be configured to monitor events (e.g., alarm events) generatedby the monitor control unit 110. In this example, the monitoringapplication server 160 may exchange electronic communications with thenetwork module 114 included in the monitor control unit 110 to receiveinformation regarding events (e.g., alarm events) detected by themonitor control unit 110. The monitoring application server 160 also mayreceive information regarding events (e.g., alarm events) from the oneor more user devices 140, 150.

The one or more user devices 140, 150 are devices that host and displayuser interfaces. For instance, the user device 140 is a mobile devicethat hosts one or more native applications (e.g., the nativesurveillance application 142). The user device 140 may be a cellularphone or a non-cellular locally networked device with a display. Theuser device 140 may include a cell phone, a smart phone, a tablet PC, apersonal digital assistant (“PDA”), or any other portable deviceconfigured to communicate over a network and display information. Forexample, implementations may also include Blackberry-type devices (e.g.,as provided by Research in Motion), electronic organizers, iPhone-typedevices (e.g., as provided by Apple), iPod devices (e.g., as provided byApple) or other portable music players, other communication devices, andhandheld or portable electronic devices for gaming, communications,and/or data organization. The user device 140 may perform functionsunrelated to the monitoring system, such as placing personal telephonecalls, playing music, playing video, displaying pictures, browsing theInternet, maintaining an electronic calendar, etc.

The user device 140 includes a native surveillance application 142. Thenative surveillance application 142 refers to a software/firmwareprogram running on the corresponding mobile device that enables the userinterface and features described throughout. The user device 140 mayload or install the native surveillance application 142 based on datareceived over a network or data received from local media. The nativesurveillance application 142 runs on mobile devices platforms, such asiPhone, iPod touch, Blackberry, Google Android, Windows Mobile, etc. Thenative surveillance application 142 enables the user device 140 toreceive notifications and electronic device information from themonitoring system.

The user device 150 may be a general-purpose computer (e.g., a desktoppersonal computer, a workstation, or a laptop computer) that isconfigured to communicate with the monitoring application server 160and/or the monitor control unit 110 over the network 105. The userdevice 150 may be configured to display a surveillance monitoring userinterface 152 that is generated by the user device 150 or generated bythe monitoring application server 160. For example, the user device 150may be configured to display a user interface (e.g., a web page)provided by the monitoring application server 160 that enables a user toperceive images captured by the camera 130 and/or reports related to themonitoring system. Although FIG. 1 illustrates two user devices forbrevity, actual implementations may include more (and, perhaps, manymore) or fewer user devices.

In some implementations, the one or more user devices 140, 150communicate with and receive monitoring system data from the monitorcontrol unit 110 using the communication link 138. For instance, the oneor more user devices 140, 150 may communicate with the monitor controlunit 110 using various local wireless protocols such as Wi-Fi,Bluetooth, zwave, zigbee, HomePlug (ethernet over powerline), or wiredprotocols such as Ethernet and USB, to connect the one or more userdevices 140, 150 to local security and automation equipment. The one ormore user devices 140, 150 may connect locally to the monitoring systemand its sensors and other devices. The local connection may improve thespeed of status and control communications because communicating throughthe network 105 with a remote server (e.g., the monitoring applicationserver 160) may be significantly slower.

In some implementations, the monitoring system may be configured todetect one or more electronic devices within the monitored propertyduring an alarm event. The monitor control unit 110 may detect an alarmevent at the monitored property. The monitor control unit 110 may thentrigger the one or more electronic device detectors 162 to attempt tocommunicate with any electronic devices within the monitored property.For example, the monitor control unit 110 may detect a security breach,and based on the detection of the security breach, the monitor controlunit 110 may trigger the one or more electronic device detectors toattempt to communicate with any electronic devices within the monitoredproperty.

In some implementations, the monitor control unit 110 may determinewhether to trigger the one or more electronic device detectors based onthe type of alarm event. For example, the monitor control unit 110 maydetermine not to trigger the one or more electronic devices when thealarm event is a fire alarm event. The monitor control unit 110 maydetermine a subset of one or more electronic device detectors 162 withinthe monitored property that should be triggered based on the location ofthe security breach. For example, the monitor control unit 110 maydetermine to trigger the one or more electronic detectors that arewithin a pre-determined distance from the one or more sensors thattriggered the alarm event.

In some implementations, the monitoring system may be configured tocapture video recordings of the monitored property during an alarmevent. The monitor control unit 110 may detect an alarm event at themonitored property, and may trigger one or more camera units 130 tobegin capturing video recordings of the area surrounding the one or morecameras. For example, an intruder may enter a monitored property andtrigger a security breach alarm event. In this example, the monitorcontrol unit 110 may trigger the one or more electronic device detectorsto attempt to communicate with the electronic devices within themonitored property, and simultaneously, trigger the one or more cameraunits to record video of the monitored property. The monitor controlunit 110 may trigger the one or more camera units that are within apre-determined distance from the one or more sensors that triggered thealarm event to capture video recording data. In addition, the monitorcontrol unit 110 may trigger the one or more camera units that arewithin a pre-determined distance from the one or more electronic devicedetectors 162 that have detected an electronic device to capture videorecording data. In some examples, the monitor control unit 110 maytrigger the one or more camera units to capture still images of themonitored property.

In some implementations, the one or more electronic device detectors maybe electronic devices configured to communicate with other electronicdevices. In these implementations, each of the one or more electronicdevices may be configured to communicate with other electronic devicesby a type of electronic signal. For example, a wireless router may beconfigured to communicate with Wi-Fi enabled electronic devices withinthe monitored property, and a DVR may be configured to communicate withBluetooth enabled devices within the monitored property. In someimplementations, the sensors 120 may act as electronic device detectors.The one or more sensors may have the ability to communicate through oneor more different wireless protocols. For example, the one or moresensors may be configured to communicate through Wi-Fi, Bluetooth, radiofrequency signals, or any other suitable electronic communicationprotocol. The monitored property may be equipped with a plurality ofelectronic sensors that are mounted throughout the property. The monitorcontrol unit 110 may communicate with the one or more electronic devicedetectors 162 over the network 105. In some examples, where the sensorsact as electronic device detectors, the monitor control unit 110 maycommunicate via the communication link 124.

In some implementations, an alarm event may be triggered by an intruderentering the monitored property. For example, an intruder may enter amonitored property and trigger a security breach alarm event. Thesecurity breach alarm event may be triggered by a sensor detecting anintruder at the monitored property. The intruder may have one or moreelectronic devices in his/her possession on entry to the monitoredproperty. For example, the intruder may have in his/her possession, asmart phone, a wearable sports band, a car key fob, an RFID fob, orother type of electronic device that communicates wirelessly and hasidentifying characteristics. The monitor control unit 110 of themonitoring system may trigger the one or more electronic devicedetectors 162 to attempt to communicate with any electronic deviceswithin the monitored property. The monitor control unit 110 may store alist of known electronic devices in its memory. The list of knownelectronic devices may include the one or more electronic devices 140,150 that are associated with the monitored property. The list of knownelectronic devices may include the electronic devices maintained withinthe property, for example, a wireless router, a DVR, a desktop computer,a laptop computer, a tablet computer, an Internet television receiver, agame console, a Bluetooth radio, etc. The list of known devices also mayinclude other electronic devices associated with users of the monitoredproperty, such as smart phones, sport bands, car key fobs, etc. The listof known devices may include the one or more electronic device detectorswithin the monitored property and the one or more other electronicdevices or components of the monitoring system. The list of knownelectronic devices associated with the monitored property may includethe name of the device, the manufacturer's identification number, andany electronic data that is specific to each device. In some examples,the list of known electronic devices associated with a monitoredproperty may be maintained on a server or in cloud storage.

In some implementations, the list of known electronic devices may bemodified by an authorized user associated with the monitored property.The authorized user may have the ability to identify an electronicdevice as known or unknown. The authorized user may access thesurveillance application on his or her mobile device and may indicatewhether a device should be considered as known or unknown. In someimplementations, the monitoring system may monitor the electronicdevices that connect to the Wi-Fi network within the monitored propertyto determine whether a device is known or unknown. In theseimplementations, the authorized user may receive a notification from themonitor control unit 110 inquiring whether an identified device shouldbe registered as a known device or not. The authorized user may respondto the notification, and the list of known devices can be updated basedon the authorized user response. For example, a friend of a user mayvisit the monitored property and join the Wi-Fi network on his/her smartphone. In this case, the authorized user may receive a notificationasking whether the friend's smart phone should be added to the list ofknown electronic devices, and based on the authorized user's approval,the smart phone device may be added to the list. In someimplementations, the list of known devices is automatically updated bythe monitoring system. The monitor control unit 110 may remove devicesfrom the known electronic device list if the electronic device has notconnected to the Wi-Fi network of the monitored property within a userset time period. For example, the monitor control unit 110 may removedevices from the list of known electronic devices if the device has notconnected to the Wi-Fi network of the monitored property within the pasttwo weeks. In some implementations, the list of known electronic devicesmay be restricted to devices used and owned by users of the monitoredproperty.

In some implementations, when the monitor control unit 110 triggers theone or more electronic device detectors to attempt to communicate withthe one or more electronic devices within the monitored property, theone or more electronic device detectors do not attempt to communicatewith any electronic device that is maintained on the list of knownelectronic devices. The one or more electronic device detectors mayattempt to communicate with any electronic devices that are within themonitored property and are not on the list of known electronic devices.

In some implementations, the intruder may enter the monitored propertywith a Wi-Fi enabled electronic device, for example, a smart phone, aWi-Fi communicator, an iPod, Nike sports band, or a Wi-Fi radio, etc.The monitor control unit 110 of the monitoring system may trigger theone or more electronic device detectors to attempt to communicate withany electronic devices within the monitored property. At least one ofthe one or more electronic device detectors may be a Wi-Fi enableddevice that is configured to be treated as a trusted Wi-Fi network byelectronic devices within its Wi-Fi network zone. This electronic devicedetector may include software that is configured to spoof the ServiceSet Identifier (SSID) of the trusted wireless networks that are saved toan electronic device. When the intruder's Wi-Fi enabled electronicdevice enters the monitored property and into the range of the Wi-Finetwork, the Wi-Fi enabled electronic device automatically attempts tocommunicate with the available Wi-Fi network. The Wi-Fi enabledelectronic device will connect to the Wi-Fi network when the electronicdevice detector mimics the SSID of one of the known Wi-Fi networksalready saved on the intruder's Wi-Fi enabled electronic device. Forexample, the intruder may enter the monitored property with a Wi-Fienabled smart phone. The electronic device detector may initiatecommunication with the intruder's smart phone, receive a uniqueidentifier or MAC address of the intruder's smart phone, and store theunique identifier or MAC address of the intruder's smart phone. Theelectronic device detector also may retrieve and store all the data thatis communicated between the Wi-Fi network and the intruder's Wi-Fienabled electronic device. The unique identifier and the datacommunicated may be stored at the electronic device detector, or may bestored on a server or in cloud storage associated with the monitoredproperty. The intruder's Wi-Fi enabled electronic device will remainconnected to the network until the device moves out of the range of thenetwork.

In some implementations, the monitored property may include a securitypanel, the security panel may be used by the user to arm and disarm thesecurity system within the monitored property. The security panel may bea Wi-Fi enabled electronic device and may act as an electronic devicedetector for Wi-Fi enabled electronic devices.

In some implementations, the intruder may enter the monitored propertywith a Bluetooth enabled electronic device, for example, a smart phone,a Bluetooth radio, a head set, etc. The monitor control unit 110 maytrigger the one or more electronic device detectors to attempt tocommunicate with any electronic devices within the monitored property.At least one of the one or more electronic device detectors may be aBluetooth enabled device. When the intruder enters the monitoredproperty and the intruder's Bluetooth enabled electronic device entersthe range of a Bluetooth enabled electronic device detector, theelectronic device detector sends out radio signals requesting a responsefrom the electronic devices within its range, including the intruder'sBluetooth enabled electronic device. The electronic device detector mayinclude software that is configured to automate the cloning of aBluetooth device name, class, and/or address that is saved to aBluetooth capable electronic device. The electronic device detector maysend radio signals to the intruder's Bluetooth enabled electronicdevice, and the intruder's device may connect automatically to thecloned Bluetooth connection. The electronic device detector software mayalso be configured to clone the identifying information of theintruder's electronic device, such as the Bluetooth MAC address. Theelectronic device detector may store the device information and anyinformation that is exchanged over the Bluetooth connection as long asthe Bluetooth enabled device is within the range of the Bluetoothnetwork.

In some implementations, the monitored property may be equipped with oneor more electronic device detectors and each electronic device detectormay be configured to communicate through one type of wireless protocol.For example, a wireless router that acts as an electronic devicedetector may be configured to only communicate with Wi-Fi enabledelectronic devices. For example, the monitored property may include oneor more sensors that act as electronic device detectors. In thisexample, a subset of the sensors are configured to communicate with RFIDdevices, a second subset of the sensors are configured to communicatewith Wi-Fi enabled devices, and a third subset is configured tocommunicate with Bluetooth enabled devices.

In some implementations, the one or more electronic device detectors areconfigured to communicate through more than one type of wirelessprotocol. For example, the one or more electronic device detectors maybe configured to communicate with both Wi-Fi and Bluetooth enableddevices. The one or more electronic device detectors may be configuredto attempt to communicate with the electronic devices within themonitored property using one type of wireless protocol at a time. Inthese implementations, the one or more electronic device detectors mayattempt to communicate with the electronic devices based on a wirelessprotocol ranked list. For example, the one or more electronic devicedetectors may attempt to communicate via Bluetooth first, then Wi-Ficommunication, then radio frequency, then infrared, and so on. In someexamples, the one or more electronic detectors may attempt tocommunicate with the electronic devices within the monitored propertyvia Wi-Fi communication first. The one or more electronic devicedetectors may attempt to communicate with one or more unknown devicesuntil identifying data unique to the unknown devices are obtained. Forexample, the one or more electronic device detectors may attempt tocommunicate with an unknown device by Bluetooth, and, if the unknowndevice is not Bluetooth enabled, no identifying information would begathered from the unknown device. The one or more electronic devicedetectors may then attempt to communicate with the unknown device byWi-Fi, and, if the electronic device is Wi-Fi enabled, it may join theWi-Fi connection. The unique identifying information from the unknownelectronic device may be stored on a server or in cloud storageassociated with the monitored property.

In some implementations, the monitor control unit 110 may detect analarm event, for example, a security breach event. The monitor controlunit 110 may send a notification to the mobile device of an authorizeduser associated with the monitored property. The notification mayinclude a request for the monitor control unit to trigger the electronicdevice detectors to start attempting to communicate with the one or moreelectronic devices within the monitored property. The authorized usermay respond to the request, and based on the user's response, themonitor control unit may trigger the electronic device detectors tostart attempting to retrieve identifying information from the electronicdevices within the monitored property. In some examples, the monitorcontrol unit 110 may trigger the electronic device detectors to startretrieving identifying information when a response to the notificationis not received within a set time period. For example, the monitorcontrol unit 110 may trigger the electronic devices to start retrievinginformation if a response is not received within two minutes. The settime period for response to the notification may be a user set timeperiod. An authorized user may access the native surveillanceapplication from a mobile device to set the time period for response tothe notification.

In some implementations, the one or more electronic device detectors atthe monitoring property are constantly retrieving identifyinginformation from electronic devices within the monitored property. Inthese implementations, the one or more electronic device detectors maybe constantly attempting to communicate with electronic devices withinthe monitored property. The electronic device detectors may generate alist of known electronic devices associated with the monitored propertyand may have the list maintained in its memory. The list of knownelectronic devices may also include any identifying data that is uniqueto the electronic device. The list of known electronic devices mayinclude the electronic devices maintained within the property, forexample, a wireless router, a DVR, a desktop computer, a laptopcomputer, a tablet computer, an Internet television receiver, a gameconsole, a Bluetooth radio, etc. The list of known devices may alsoinclude other electronic devices associated with users of the monitoredproperty, such as smart phones, sport bands, car key fobs, etc. The listof known electronic devices may be maintained on a server or in cloudstorage associated with the monitoring system.

In some examples, the one or more electronic device detectors 162passively monitor for information from electronic devices located withinthe property. In these examples, the one or more electronic devicedetectors 162 listen for communications originating from electronicdevices located within the property and record any useful informationfrom communications received as part of the listening. The usefulinformation may include any type of information that assists inidentifying the electronic device that originated the communication.

In some implementations, the one or more electronic device detectors 162actively request information from electronic devices located within theproperty. In these implementations, the one or more electronic devicedetectors 162 initiate communications to electronic devices locatedwithin the property and attempt to get electronic devices located withinthe property to respond. For instance, the one or more electronic devicedetectors 162 may send requests to establish a communication sessionwith other electronic devices and then monitor for responses to therequests. The requests may be broadcasts of availability of a network(e.g., a Wi-Fi network) or invitations to establish a direct connection(e.g., a Bluetooth pairing request). The one or more electronic devicedetectors 162 may analyze and store information received in response tothe request in an attempt to obtain identifying information for thedevice responding to the request. If no identifying information isreceived, the one or more electronic device detectors 162 may activelysend additional requests for identifying information from the detectedelectronic devices.

Although the one or more electronic device detectors 162 may betriggered in response to an alarm event as described above, the one ormore electronic device detectors 162 also may be configured tocontinuously (or periodically) track identifying information or “digitalfingerprints” of devices located within the property. In this regard,the one or more electronic device detectors 162 may passively oractively monitor for electronic devices and record any identifyinginformation received from detected devices in a log. The monitor controlunit 110 may send the data in the log to the monitoring applicationserver 160 in response to an alarm event or request by a user.

In some implementations, a log of electronic device information may beanalyzed to determine certain information about the monitored property.For instance, the log of electronic device information may be comparedagainst electronic device identifiers detected during an alarm event inan attempt to determine whether the electronic devices detected duringthe alarm event have been in the monitored property previously and whenthey were in the monitored property. If the comparison reveals that oneor more of the electronic devices detected during the alarm event werepreviously in the property, a report may be generated to show when theone or more electronic devices were in the property, which may be usefulin identifying an intruder.

In some examples, the log of electronic device information may be usedfor alerting during monitoring electronic devices that enter theproperty. In these examples, electronic devices that have entered theproperty may be compared against the log to determine whether theelectronic devices have been present before in a legitimate capacity. Ifnot, an alert may be provided to a user. For instance, the user maycontract a maid service to clean his or her home. In this instance, whenthe typical set of maids enters the property to clean, an alert is notprovided because the log would include the electronic devices used bythe typical set of maids during a past cleaning. However, if a new maidor a different set of maids enters the property, the user may be alertedbecause the electronic devices of the new maid or the different set ofmaids are new to the property. In this regard, the user may be alertedto a new individual in his or her home and may take any action the userdeems appropriate.

In addition, the log may be used to provide information to the userabout the individuals in the property. For example, the log may be usedto report to the user the number of devices at the property (e.g.,number of unknown devices). In this example, the user may determinewhether unauthorized use of the property is taking place, such as achild throwing an unauthorized party at the property reflected by arelatively large number of electronic devices at the property. Also, thelog may be used to indicate which user devices are at the property at agiven time. For instance, the user may request information on who iscurrently at the property and the log may be consulted to detect whichof the known mobile devices are located in the property (e.g., dad andson are home, daughter is not home).

FIGS. 2, 4, 6, 8, 10, and 12 illustrate flowcharts of example processes.The operations of the example processes are described generally as beingperformed by the system 100. The operations of the example processes maybe performed by one of the components of the system 100 (e.g., themonitor control unit 110, the monitoring application server 160, etc.)or may be performed by any combination of the components of the system100. In some implementations, operations of the example processes may beperformed by one or more processors included in one or more electronicdevices.

FIG. 2 illustrates an example process 200 for storing informationindicating electronic identifiers for mobile electronic devicesdetermined to be in a monitored property. The system 100 detects analarm event at a monitored property (210). The system 100 may detect thealarm event based on output from at least one sensor located at themonitored property. For example, the monitor control unit 110 maydetermine that an alarm event type of security breach has occurredbecause the security system was set to armed, a door sensor provided anoutput to the monitor control unit 110 indicating that a door wasopened, and the security system was not disarmed within one minute ofthe door opening. In another example, the monitor control unit 110 maydetermine that a fire alarm event has been detected based on determiningthat a smoke sensor has provided an output to the monitor control unit110 that indicates that a level of smoke is above a thresholdcorresponding with a fire within the monitored property.

In response to detecting the alarm event at the monitored property, thesystem 100 initiates a process to gather electronic identifiers formobile electronic devices located within the monitored property at atime corresponding to the detected alarm event (220). For example, inresponse to detecting an alarm event, the monitor control unit 110 mayinstruct the electronic device detector 162 to wirelessly broadcast arequest for electronic identifiers from all mobile electronic deviceswithin the monitored property. As described above in relation to FIG. 1,the electronic device detector 162 may use various wireless protocols,such as wifi, Bluetooth, Bluetooth LE, zwave, zigbee, RFID, Near FieldCommunication, or another short-range wireless communication protocol torequest electronic identifiers, and may spoof a trusted wireless networkor trusted device so that electronic devices within the property mayidentify themselves. In some implementations, the monitoring applicationserver 160 may provide updates regarding trusted networks or trusteddevices that the electronic device detector 162 may spoof using theupdates.

Additionally or alternatively, in initiating a process to gatherelectronic identifiers, the monitor control unit 110 may send anotification to the mobile device of an authorized user associated withthe monitored property. The notification may include a request for themonitor control unit to trigger the electronic device detectors to startattempting to communicate with the one or more electronic devices withinthe monitored property. The authorized user may respond to the request,and based on the user's response, the monitor control unit may triggerthe electronic device detectors to start attempting to retrieveidentifying information from the electronic devices within the monitoredproperty. In some examples, the monitor control unit 110 may trigger theelectronic device detectors to start retrieving identifying informationwhen a response to the notification is not received within a set timeperiod. For example, the monitor control unit 110 may trigger theelectronic devices to start retrieving information if a response is notreceived within two minutes. The set time period for response to thenotification may be a user set time period. An authorized user mayaccess the native surveillance application from a mobile device to setthe time period for response to the notification.

In another example, the one or more electronic device detectors at themonitoring property may constantly retrieve identifying information fromelectronic devices within the monitored property and in response todetecting an alarm event, the monitor control unit 110 may access apre-existing log of electronic identifiers detected within the monitoredproperty or a most recent list of electronic identifiers detected withinthe monitored property. The monitor control unit 110 may access a log ofelectronic identifiers for mobile electronic devices detected within themonitored property and select a subset of the electronic identifiersbased on a time corresponding to the detected alarm event, e.g.,selecting the electronic identifiers that were detected in response tomost recent request for electronic identifiers or selecting theelectronic identifiers that were detected within the last five minutes,selecting the electronic identifiers that were detected within the pastthirty minutes, etc.

The system 100 determines electronic identifiers for the mobileelectronic devices located within the monitored property (230). Forexample, the monitor control unit 110 may receive responses from mobileelectronic devices located within the monitored property, where theresponse from each mobile electronic device includes an electronicidentifier for the mobile electronic device, and may extract theelectronic identifiers for the mobile electronic devices from theresponses. In another example, the monitor control unit 110 maydetermine the electronic identifiers, from the log of electronicidentifiers for mobile electronic devices previously detected within themonitored property, for mobile electronic devices detected in themonitored property at a time that correspond to the detected alarmevent.

The system 100 stores information indicating the determined electronicidentifiers for the mobile electronic devices (240). For example, themonitor control unit 110 may generate a report that indicates electronicidentifiers for mobile electronic devices located within the monitoredproperty at a time corresponding to the detected alarm event. The reportmay indicate the type of alarm event and the electronic identifiers. Inanother example, the monitor control unit 110 may add the determinedelectronic identifiers for the mobile electronic devices detected withinthe monitored property to the log of electronic identifiers.

FIG. 3 illustrates an example system 300 for storing informationindicating electronic identifiers for mobile electronic devices locatedwithin a monitored property 310. The monitor control unit 110 mayreceive one or more outputs from the sensors 120 in the monitoredproperty 310 and in response, detect an alarm event. For example, themonitor control unit 110 may receive an output from a window sensor thatindicates that a window was opened, receive an output from a motionsensor near the window that indicates that motion was detected withinthe monitored property 310, determine that the security system is armed,and in response, determine that an alarm event type of security breachis detected.

In response to detecting the alarm event, the monitor control unit 110may initiate a process to gather electronic identifiers for mobileelectronic devices located within the monitored property at a timecorresponding to the detected alarm event. For example, the monitorcontrol unit 110 may instruct the electronic device detector 162 totransmit a request for electronic identifiers of all mobile electronicdevices located within the monitored property, and an intruder device360, e.g., a mobile electronic device of an intruder, may receive therequest. In another example, additionally or alternatively, the monitorcontrol unit 110 may access a pre-existing log of electronic identifiersdetected within the monitored property or a most recent list ofelectronic identifiers detected within the monitored property.

The monitor control unit 110 may determine electronic identifiers forthe mobile electronic devices located within the monitored property at atime corresponding to the detected alarm event. For example, the monitorcontrol unit 110 may receive, from the electronic device detector 162,the response from the intruder device 360 and extract an electronicidentifier for the intruder device 360. In another example, theelectronic device detector 162 may receive the response from theintruder device 360, extract the electronic identifier from theresponse, and provide the electronic identifier to the monitor controlunit 110.

The monitor control unit 110 may store information indicating thedetermined electronic identifiers for the mobile electronic devices. Forexample, the monitor control unit 110 may generate a report thatindicates “Alarm event type: Security Breach; Devices detected: Unknowndevice with MAC 00:0a:95:9d:68:16” and provide the report to amonitoring application server 160. In some implementations, the reportmay indicate when the device was first detected in the monitoredproperty. The monitoring application server 160 may then provide thereport to a central server 392 that may dispatch security personnel tothe monitored property 310 and provide the report to a homeowner device,e.g., the user device 150.

FIG. 4 illustrates an example process 400 for selecting an electronicdevice detection procedure appropriate for a determined type of detectedalarm event. The system 100 detects, from among multiple types of alarmevent, a type of alarm event detected at a monitored property (410). Forexample, the monitor control unit 110 may determine that a fire alarmevent type is detected at a monitored property. In another example, themonitor control unit 110 may determine that a security breach alarmevent type is detected at a monitored property.

The system 100 selects from among multiple electronic device detectionprocedures, an electronic device detection procedure appropriate for thedetermined type of the detected alarm event (420). For example, themonitor control unit 110 may select an electronic device detectionprocedure for a security breach alarm event type from multipleelectronic device detection procedures including a procedure for a firealarm event type, a procedure for a security breach alarm event type, aprocedure for a water leak alarm event, and procedures for other alarmevent types. The electronic device detection procedure for the firealarm event type may describe that the system 100 should determine whathousehold members may be in the monitored property based at least onmobile electronic devices detected within the property and notify thehome owner of who may be in the monitored property. The electronicdevice detection procedure for the security breach alarm event maydescribe that the system 100 should determine whether unknown mobileelectronic devices are in the monitored property and notify the homeowner of any unknown mobile electronic devices detected within themonitored property.

The system executes the selected electronic device detection procedure(430). For example, in executing a selected electronic device detectionprocedure for an alarm event type of security breach, the monitorcontrol unit 110 may determine what unknown mobile electronic devicesmay be in the monitored property and notify the home owner of whatunknown mobile electronic devices are detected within the monitoredproperty.

FIG. 5 illustrates an example system 500 for selecting an electronicdevice detection procedure appropriate for a determined type of detectedalarm event. The monitor control unit 110 may determine an alarm eventtype of fire is detected and in response select, from multipleelectronic device detection procedures, an electronic device detectionprocedure for the alarm event type of fire. The electronic devicedetection procedure for the alarm event type of fire may includedetermine the electronic identifiers for mobile electronic deviceslocated within the monitored property at a time corresponding to thedetected fire alarm event type, determine the electronic identifiersthat are in a list of known electronic identifiers, determine users thatare indicated in the list as associated with the known electronicidentifiers, and provide a homeowner an alert indicating the fire alarmevent and users that have mobile electronic devices detected within themonitored property when the fire alarm event was detected. According,the monitor control unit 110 may execute the electronic device detectionprocedure for the alarm event type of fire, determine that an electronicidentifier for Jane Doe's mobile electronic device 510 is detected,determine that the electronic identifier for Jane Doe's mobileelectronic device 510 is known and is associated with Jane Doe, andprovide the monitoring application server 160 an indication that analarm event type of fire was detected and that the only known mobileelectronic device detect in the monitored property was Jane Doe's, e.g.,provide a report that includes “Alarm event type: Fire detected; Devicesdetected: Jane Doe's smartphone.” The monitoring application server 160may then provide the homeowner device 150 an alert of “Fire detected andJane Doe's phone is home.”

FIG. 6 illustrates an example process 600 for identifying devicedetectors to detect mobile electronic devices. The process 600 may beincluded in initiating a process to gather electronic identifiers (220)and determine electronic identifiers (230) as described above inrelation to FIG. 2.

The system 100 determines a location that is associated with an alarmevent (610). For example, the monitor control unit 110 may determinethat an alarm event of security breach is associated with a location ofa door that was sensed to be opened while the security system was armed.In another example, the monitor control unit 110 may determine that analarm event of fire is associated with a location of a smoke sensor thatsensed a high level of smoke corresponding to a fire.

The system 100 identifies a device detector closest or within athreshold distance of the determined location (620). For example, themonitor control unit 110 may determine that electronic device detector Ais within a threshold distance, e.g., within twenty feet from thedetermined location, and in response identify electronic device detectorA as within a threshold distance of the determined location.

The system 100 triggers the identified device detector to transmit arequest for responses (630). For example, in response to identifyingelectronic device detector A, the monitor control unit 110 may instructelectronic device detector A to transmit a request for responses fromall mobile electronic devices that receive the request from electronicdevice detector A.

The system 100 receives the responses from the mobile electronic devices(640). For example, the monitor control unit 110 may receive responsesfrom electronic device detector A that electronic device detector Areceived from mobile electronic devices within the monitored property.

The system 100 extracts electronic identifiers from the responses (650).For example, for each response from a mobile electronic device, themonitor control unit 110 may extract an electronic identifier for themobile electronic device that provided the response.

FIG. 7 illustrates an example system 700 for identifying devicedetectors to detect mobile electronic devices. The monitor control unit110 may determine a location that is associated with an alarm event. Forexample, the monitor control unit 110 may detect an alarm event of asecurity breach type and in response determine that sensor dataindicates that the security breach occurred near a particular part of amonitored property. The monitor control unit 110 may identify a devicedetector closest or within a threshold distance of the location. Forexample, the monitor control unit 110 may identify that electronicdevice detector A 162 and electronic device detector B 710 are bothlocated within the monitored property and that electronic devicedetector B 710 is closest to the determined location. The monitorcontrol unit 110 may trigger the identified device detector to transmita request for responses. For example, in response to determining thatelectronic device detector B 710 is closest to the determined location,the monitor control unit 110 may provide an instruction to onlyelectronic device detector B 710 to request responses that includeelectronic identifiers for all mobile electronic that receive therequest. The monitor control unit 110 may receive the responses from themobile electronic devices 640. For example, the intruder device 360 mayprovide a response that includes an electronic identifier of“00:0a:95:9d:68:16,” and the electronic device detector B 710 mayreceive the response and provide the response to the monitor controlunit 110. The monitor control unit 110 may extract electronicidentifiers from the responses. For example, the monitor control unit110 may extract the electronic identifier of “00:0a:95:9d:68:16” fromthe response of the intruder device 360.

FIG. 8 illustrates an example process 800 for determining an alarmresponse appropriate for mobile electronic devices located within amonitored property. The system 100 evaluates the determined electronicidentifiers for the mobile electronic devices located within themonitored property (810). For example, the monitor control unit 110 mayidentifier whether electronic identifiers for mobile electronic deviceslocated within the monitored property at a time corresponding to adetected alarm event are associated with known mobile electronic devicesor associated with unknown mobile electronic devices.

The system 100 determines an alarm response for the alarm event that isappropriate for the mobile electronic devices located within themonitored property (820). For example, the monitor control unit 110 maydetermine that the alarm type is a security breach and that an unknownmobile electronic device is detected within the monitored property. Inanother example, the monitor control unit 110 may determine that thealarm type is a security breach and that no unknown mobile electronicdevices are detected within the monitored property. In yet anotherexample, the monitor control unit 110 may determine that the alarm typeis fire and that known mobile electronic devices are detected within themonitored property.

The system 100 handles the detected alarm event based on the determinedalarm response for the alarm event that is appropriate for the mobileelectronic devices located within the monitored property (830). Forexample, in response to determining that the alarm type is a securitybreach and that an unknown mobile electronic device is detected withinthe monitored property, the monitor control unit 110 may instruct acamera to record a location associated with the security breach. Inanother example, in response to determining that the alarm type is fireand that known mobile electronic devices are detected within themonitored property, the monitoring control unit 110 may determine toprovide an alert of the fire to all the known mobile electronic devicesdetected within the monitored property and notify a homeowner that theusers of the known mobile electronic devices may be in danger from thefire as their mobile electronic devices are within the monitoredproperty so the users may be in the monitored property.

FIG. 9 illustrates an example system 900 for determining an alarmresponse appropriate for mobile electronic devices located within amonitored property. The monitor control unit 110 may evaluate thedetermined electronic identifiers for the mobile electronic deviceslocated within the monitored property. For example, the monitor controlunit 110 may evaluate an electronic identifier extracted from a responseof the intruder device 360 and determine that the electronic identifiercorresponds to an unknown mobile electronic device as the electronicidentifier does not correspond to an electronic identifier in a list ofknown electronic identifiers. The monitor control unit 110 may determinean alarm response for the alarm event that is appropriate for the mobileelectronic devices located within the monitored property. For example,the monitor control unit 110 may determine that the alarm event is of atype of security breach and that an unknown mobile electronic device isdetected, and in response, determine to trigger a camera 910 to record alocation. The monitor control unit 110 may handle the detected alarmevent based on the determined alarm response for the alarm event that isappropriate for the mobile electronic devices located within themonitored property. For example, the monitor control unit 110 mayprovide information to the monitoring application server 160 thatincludes “Alarm event type: Security Breach; Devices detected: Unknowndevice with MAC 00:0a:95:9d:68:16; Camera stream for detected locationof Unknown device.” The monitoring application server 160 may thenprovide an alert to the homeowner device 150. The alert may include“Security breach detected and unknown device detected. Camera stream oflocation of unknown device available.”

FIG. 10 illustrates an example process 1000 for triggering anappropriate alarm response based on determined electronic identifiers ofmobile electronic devices. The system 100 obtains a list of electronicidentifiers for mobile electronic devices known for the monitoredproperty (1010). For example, the monitor control unit 110 may access astored list of known devices that are associated with the monitoredproperty.

The system 100 compares determined electronic identifiers for mobileelectronic devices to the list of electronic identifiers (1020). Forexample, for each electronic identifier for a mobile electronic devicedetermined to be within the monitored property at a time correspondingto the alarm event, the monitor control unit 110 may determine whetherthe electronic identifier matches an electronic identifier in the accesslist of known devices that are associated with the monitored property.

For each matching electronic identifier, the system 100 identifies auser associated with the electronic identifier (1030). For example, themonitor control unit 110 may determine that an electronic identifiermatches an electronic identifier for a known mobile electronic deviceand may determine that the stored list indicates that the known mobileelectronic device is associated with Jane Doe.

The system 100 triggers an alarm response appropriate for the identifieduser (1040). For example, the monitor control unit 110 may provide analert to Jane Doe's device that a fire is detected in the monitoredproperty or that an intruder is detected within the monitored property,or provide an alert to a device of the homeowner that Jane Doe's deviceis within the monitored property and a fire is detected.

For each non-matching electronic identifier, the system 100 triggers analarm response appropriate for unknown devices (1050). For example, themonitor control unit 110 may trigger a camera to record a locationassociated with an unknown mobile electronic device and provide an alertto a homeowner indicating the electronic identifier of the unknownmobile electronic device and including a video recording of the locationassociated with the unknown mobile electronic device.

FIG. 11 illustrates an example system 1100 for triggering an appropriatealarm response based on determined electronic identifiers of mobileelectronic devices. The monitor control unit may obtain a list ofelectronic identifiers for mobile electronic devices known for themonitored property. For example, the monitor control unit 110 may accessthe known device list 322 that indicates that Jane Doe's and the homeowner's mobile electronic devices are known to be associated with themonitored property. The monitor control unit 110 may compare determinedelectronic identifiers for mobile electronic devices to the list ofelectronic identifiers. For example, the monitor control unit 110 maydetermine a MAC of 00:0a:95:9d:68:16 from the intruder's device 360 anda MAC of 11:11:11:11:11:11 from a homeowner's child's device to the listof electronic identifiers. For each non-matching electronic identifier,the monitor control unit 110 may trigger an alarm response appropriatefor the unknown device and for each matching electronic identifier, themonitor control unit 110 may trigger an alarm response appropriate forthe known device. For example, the monitor control unit 110 maydetermine that the MAC of 00:0a:95:9d:68:16 does not match the MAC ofany electronic identifier in the list but that the MAC of11:11:11:11:11:11 is associated with a mobile electronic device of thechild of the homeowner, and in response, trigger an alert to thehomeowner that an unknown device with the MAC of 00:0a:95:9d:68:16 isdetected within the monitored property and the homeowner's child'smobile device is also detected within the monitored property, e.g., analert of “Security breath detected, unknown device detected, and JaneDoe's phone is home. Sending a silent vibrational alert and message toJane Doe's phone,” and trigger an alert to the known mobile electronicdevice, e.g., a silent vibrational alert and message that there is anintruder.

FIG. 12 illustrates an example process 1200 for taking action based on adetermined mobile electronic device profile. The system 100 monitors,over time, mobile electronic device identifiers present within themonitored property (1210). For example, the monitor control unit 110 maymonitor when electronic identifiers are detected for mobile electronicdevices within the monitored property across hours, days, weeks, ormonths, or other time periods, and store information indicating when theelectronic identifiers were detected.

The system 100 monitors, over time, system data for the monitoredproperty (1220). For example, the monitor control unit 110 may monitorsensor data and alarm event types across hours, days, weeks, months, orother time periods, and store information indicating the system data.

The system 100 determines a mobile electronic device profile for themonitored property based on the monitored mobile electronic deviceidentifiers and the monitored system data (1230). For example, themonitor control unit 110 may determine a profile that describes whatmobile electronic device identifiers are frequently detected for whatmonitored system data.

The system 100 takes action based on the determined mobile electronicdevice profile (1240). For example, the monitor control unit 110 maydetermine that an electronic identifier not frequently detected at aparticular time of day is being detected at the particular time of day,and in response, generate an alert to a homeowner. In another example,the monitor control unit 110 may determine that an electronic identifierthat is frequently detected for a particular day is not detected for theparticular day, and in response, generate an alert to a homeowner.

FIG. 13 illustrates an example system 1300 for taking action based on adetermined mobile electronic device profile. The monitor control unit110 may monitor detected electronic identifiers and system data, and inresponse, generate a mobile electronic device profile that describes anelectronic identifier of a maid's mobile electronic device is typicallydetected between 2-3 PM on Monday. The monitor control unit 110 maydetermine using the mobile electronic device profile that the maid'smobile electronic device is not detected at 2 PM on Monday and anelectronic identifier of an unknown mobile electronic device isdetected, and in response, provide information to the monitoringapplication server 160 indicating “Devices detected: Unknown device withMAC 00:0a:95:9d:68:16.” In response, the monitoring application server160 may provide an alert of “The known device of your typical maid wasnot detected at the cleaning time and an unknown device was detected” tothe homeowner device 150.

FIG. 14 illustrates an example system 1400 for taking action based on adetermined mobile electronic device profile. The monitor control unit110 may monitor detected electronic identifiers and system data, and inresponse, generate a mobile electronic device profile that describes anelectronic identifier of Jane Doe's mobile electronic device istypically not detected between 10-4 PM on weekdays. The monitor controlunit 110 may determine using the mobile electronic device profile thatJane Doe's mobile electronic device is detected at 11 AM on Monday, andin response, provide information to the monitoring application server160 indicating “Devices detected: Jane Doe's smartphone.” In response,the monitoring application server 160 may provide an alert of “JaneDoe's smartphone is home and usually it is not at this time” to thehomeowner device 150.

Described systems, methods, and techniques may be implemented in digitalelectronic circuitry, computer hardware, firmware, software, or incombinations of these elements. Apparatus implementing these techniquesmay include appropriate input and output devices, a computer processor,and a computer program product tangibly embodied in a machine-readablestorage device for execution by a programmable processor. A processimplementing these techniques may be performed by a programmableprocessor executing a program of instructions to perform desiredfunctions by operating on input data and generating appropriate output.The techniques may be implemented in one or more computer programs thatare executable on a programmable system including at least oneprogrammable processor coupled to receive data and instructions from,and to transmit data and instructions to, a data storage system, atleast one input device, and at least one output device. Each computerprogram may be implemented in a high-level procedural or object-orientedprogramming language, or in assembly or machine language if desired; andin any case, the language may be a compiled or interpreted language.Suitable processors include, for example, both general and specialpurpose microprocessors. Generally, a processor will receiveinstructions and data from a read-only memory and/or a random accessmemory. Storage devices suitable for tangibly embodying computer programinstructions and data include all forms of non-volatile memory,including by way of example semiconductor memory devices, such asErasable Programmable Read-Only Memory (EPROM), Electrically ErasableProgrammable Read-Only Memory (EEPROM), and flash memory devices;magnetic disks such as internal hard disks and removable disks;magneto-optical disks; and Compact Disc Read-Only Memory (CD-ROM). Anyof the foregoing may be supplemented by, or incorporated in,specially-designed ASICs (application-specific integrated circuits).

It will be understood that various modifications may be made. Forexample, other useful implementations could be achieved if steps of thedisclosed techniques were performed in a different order and/or ifcomponents in the disclosed systems were combined in a different mannerand/or replaced or supplemented by other components. Accordingly, otherimplementations are within the scope of the disclosure.

What is claimed is:
 1. A computer-implemented method comprising:detecting an alarm event at a monitored property based on output from atleast one sensor located at the monitored property; in response todetecting the alarm event at the monitored property, initiating aprocess to gather electronic identifiers for mobile electronic deviceslocated within the monitored property at a time corresponding to thedetected alarm event; based on the process to gather electronicidentifiers for mobile electronic devices located within the monitoredproperty at a time of the detected alarm event, determining electronicidentifiers for the mobile electronic devices located within themonitored property at a time corresponding to the detected alarm event;and storing, in electronic storage, information indicating thedetermined electronic identifiers for the mobile electronic deviceslocated within the monitored property at a time corresponding to thedetected alarm event.
 2. The method of claim 1, wherein determiningelectronic identifiers for the mobile electronic devices located withinthe monitored property at a time corresponding to the detected alarmevent comprises: transmitting, by a device detector located at themonitored property and through a wireless communication protocol, arequest for responses from mobile electronic devices at the monitoredproperty, wherein each response includes the electronic identifier forthe mobile electronic device that received the request.
 3. The method ofclaim 1, wherein determining electronic identifiers for the mobileelectronic devices located within the monitored property at a timecorresponding to the detected alarm event comprises: accessing storedinformation indicating electronic identifiers for mobile electronicdevices detected within the monitored property before the alarm eventwas detected.
 4. The method of claim 1, wherein the electronicidentifiers include media access control (MAC) addresses.
 5. The methodof claim 1, wherein detecting an alarm event at a monitored propertybased on output from at least one sensor located at the monitoredproperty comprises: detecting a security breach at the monitoredproperty based on output from a door sensor that indicates a door isopened when a security system is armed.
 6. The method of claim 1,comprising: determining, from among multiple types of alarm events, atype of the detected alarm event; based on the determined type of thedetected alarm event, selecting, from among multiple electronic devicedetection procedures, an electronic device detection procedureappropriate for the determined type of the detected alarm event; andexecuting the selected electronic device detection procedure.
 7. Themethod of claim 6, wherein the type of the detected alarm eventcomprises a fire event and the electronic device detection proceduresincludes determining known mobile electronic devices within themonitored property and providing an alert that indicates the knownmobile electronic devices determined to be within the monitoredproperty.
 8. The method of claim 6, wherein the type of the detectedalarm event comprises a security breach event and the electronic devicedetection procedures includes determining unknown mobile electronicdevices within the monitored property and providing an alert thatindicates the unknown mobile electronic devices determined to be withinthe monitored property.
 9. The method of claim 1, wherein the process togather electronic identifiers for mobile electronic devices locatedwithin the monitored property at a time corresponding to the detectedalarm event comprises: determining a location, within the monitoredproperty, that is associated with the alarm event; identifying a devicedetector located closest or within a threshold distance of the locationthat is associated with the alarm event; triggering the identifieddevice detector to transmit a request for responses from mobileelectronic devices at the monitored property; receiving the responsesfrom the mobile electronic devices at the monitored property; andextracting, from each response, an electronic identifier for the mobileelectronic device that provided the response.
 10. The method of claim 1,comprising: evaluating the determined electronic identifiers for themobile electronic devices located within the monitored property at atime corresponding to the detected alarm event against one or morerules; based on the evaluation, determining an alarm response for thealarm event that is appropriate for the mobile electronic deviceslocated within the monitored property at a time corresponding to thedetected alarm event; and handling the detected alarm event based on thedetermined alarm response for the alarm event that is appropriate forthe mobile electronic devices located within the monitored property at atime corresponding to the detected alarm event.
 11. The method of claim10, wherein determining an alarm response for the alarm event that isappropriate for the mobile electronic devices located within themonitored property at a time corresponding to the detected alarm eventcomprises: in response to determining the mobile electronic devicesinclude an unknown mobile electronic device, determining an alarmresponse corresponding to detection of an unknown mobile electronicdevice.
 12. The method of claim 1, comprising: determining that anelectronic identifier received corresponds to an electronic identifierof a mobile electronic device known for the monitored property;identifying a user associated with the mobile electronic device knownfor the monitored property; identifying an alarm response correspondingto the user associated with the mobile electronic device known for themonitored property; and triggering the identified alarm responsecorresponding to the user associated with the mobile electronic deviceknown for the monitored property.
 13. A system comprising: one or morecomputers; and one or more storage devices storing instructions that areoperable, when executed by the one or more computers, to cause the oneor more computers to perform operations comprising: detecting an alarmevent at a monitored property based on output from at least one sensorlocated at the monitored property; in response to detecting the alarmevent at the monitored property, initiating a process to gatherelectronic identifiers for mobile electronic devices located within themonitored property at a time corresponding to the detected alarm event;based on the process to gather electronic identifiers for mobileelectronic devices located within the monitored property at a time ofthe detected alarm event, determining electronic identifiers for themobile electronic devices located within the monitored property at atime corresponding to the detected alarm event; and storing, inelectronic storage, information indicating the determined electronicidentifiers for the mobile electronic devices located within themonitored property at a time corresponding to the detected alarm event.14. The system of claim 13, wherein determining electronic identifiersfor the mobile electronic devices located within the monitored propertyat a time corresponding to the detected alarm event comprises:transmitting, by a device detector located at the monitored property andthrough a wireless communication protocol, a request for responses frommobile electronic devices at the monitored property, wherein eachresponse includes the electronic identifier for the mobile electronicdevice that received the request.
 15. The system of claim 13, whereindetermining electronic identifiers for the mobile electronic deviceslocated within the monitored property at a time corresponding to thedetected alarm event comprises: accessing stored information indicatingelectronic identifiers for mobile electronic devices detected within themonitored property before the alarm event was detected.
 16. The systemof claim 13, wherein the electronic identifiers include media accesscontrol (MAC) addresses.
 17. The system of claim 13, wherein detectingan alarm event at a monitored property based on output from at least onesensor located at the monitored property comprises: detecting a securitybreach at the monitored property based on output from a door sensor thatindicates a door is opened when a security system is armed.
 18. Acomputer-implemented method comprising: monitoring, over time, mobileelectronic device identifiers present within the monitored property;monitoring, over time, system data for the monitored property;determining a mobile electronic device profile for the monitoredproperty based on the monitored mobile electronic device identifiers andthe monitored system data; and taking action based on the determinedmobile electronic device profile.
 19. The method of claim 18, whereinthe monitored system data comprises one or more of system status data orsensor data.
 20. The method of claim 18, wherein taking action based onthe determined mobile electronic device profile comprises identifyingmobile electronic device identifiers for mobile electronic devicesfrequently detected within the monitored property and providing an alertwhen a mobile electronic device identifier not identified as for amobile electronic devices frequently detected within the monitoredproperty is detected within the monitored property.